CVE-2026-1320

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1320", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-22T01:20:10.757Z", "datePublished": "2026-02-12T13:25:33.643Z", "dateUpdated": "2026-04-08T17:20:45.707Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:20:45.707Z"}, "affected": [{"vendor": "ays-pro", "product": "Secure Copy Content Protection and Content Locking", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.9.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' HTTP header in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Secure Copy Content Protection and Content Locking <= 4.9.8 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c4dd681d-90cb-44dc-adf0-d7e269d15a60?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3449531/secure-copy-content-protection"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Deadbee"}], "timeline": [{"time": "2026-01-22T01:36:14.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-12T01:05:30.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-12T14:08:23.388506Z", "id": "CVE-2026-1320", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T14:08:30.210Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1320", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-12T14:08:23.388506Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T14:08:26.355Z"}}], "cna": {"title": "Secure Copy Content Protection and Content Locking <= 4.9.8 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header", "credits": [{"lang": "en", "type": "finder", "value": "Deadbee"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ays-pro", "product": "Secure Copy Content Protection and Content Locking", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.9.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-22T01:36:14.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-12T01:05:30.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c4dd681d-90cb-44dc-adf0-d7e269d15a60?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3449531/secure-copy-content-protection"}], "descriptions": [{"lang": "en", "value": "The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' HTTP header in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:20:45.707Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1320", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:20:45.707Z", "dateReserved": "2026-01-22T01:20:10.757Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-12T13:25:33.643Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Secure Copy Content Protection and Content Locking", "vendor": "ays-pro", "versions": [{"lessThanOrEqual": "4.9.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' HTTP header in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Secure Copy Content Protection y Content Locking para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del encabezado HTTP 'X-Forwarded-For' en todas las versiones hasta la 4.9.8, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes no autenticados inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-1320", "lastModified": "2026-06-17T10:15:35.570", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1320", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-12T14:08:23.388506Z", "version": "2.0.3"}}]}, "published": "2026-02-12T14:16:01.623", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3449531/secure-copy-content-protection"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c4dd681d-90cb-44dc-adf0-d7e269d15a60?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.9.8]"}}], "product": "secure_copy_content_protection_and_content_locking", "vendor": "ays-pro"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T20:44:58.065173+00:00", "value": {"mitigation_remediation": ["Update Secure Copy Content Protection and Content Locking to the latest available version or apply the vendor\u2019s official patch for versions 4.9.8 and earlier.", "If an immediate update is not possible, configure the web server or reverse proxy to strip or filter the X-Forwarded-For header before it reaches the application. A ModSecurity rule that rejects or sanitizes the header can serve as a temporary defense.", "If an update is infeasible, consider deactivating the plugin entirely or replacing it with a secure alternative until the vendor releases a fix."], "summary": {"action": "Immediate Patch", "impact": "Stored XSS allowing execution of arbitrary scripts in a victim\u2019s browser"}, "threat_synthesis": {"affected_systems": "All WordPress sites that have the Secure Copy Content Protection and Content Locking plugin installed, with version 4.9.8 or earlier, are affected. The vulnerability is limited to that plugin and does not impact other parts of WordPress.", "description_and_impact": "The Secure Copy Content Protection and Content Locking plugin contains a stored cross\u2011site scripting flaw that arises from using the 'X-Forwarded-For' HTTP header without proper input sanitization or output escaping. Because the plugin persists the header value and later renders it directly, malicious payloads can be stored and executed in the browser of anyone who views the affected page. This allows an unauthenticated attacker to inject arbitrary JavaScript that will run in the context of the victim when the page is accessed.", "risk_and_exploitability": "The flaw carries a CVSS score of 7.2, indicating high severity. EPSS is less than 1\u202f%, indicating a very low probability of exploitation, and it is not listed in the CISA KEV catalog. An attacker does not need credentials; they simply send an HTTP request containing a malicious X-Forwarded-For header to the vulnerable site. The request stores the payload, and when a user later accesses a page that displays the stored header, the injected script executes in the user\u2019s browser. The attack vector is typically a crafted HTTP request sent to the target system."}}}}, "created": "2026-02-13T21:35:36.273708+00:00", "updated": "2026-04-15T20:45:06.392930+00:00", "vendors": ["ays-pro", "ays-pro$PRODUCT$secure_copy_content_protection_and_content_locking", "wordpress", "wordpress$PRODUCT$wordpress"]}